Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
17/10/2024, 01:54
General
- Target 86b9d17c28f513e6610f028215365d251053d95326a6e2d4dc5d3d84d791887e.exe
- Size 1.8MB
- Sample241017-cbqd1awdpd
- SHA256 86b9d17c28f513e6610f028215365d251053d95326a6e2d4dc5d3d84d791887e
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
lumma
-
https://drawwyobstacw.sbs
-
https://condifendteu.sbs
-
https://ehticsprocw.sbs
-
https://vennurviot.sbs
-
https://resinedyw.sbs
-
https://enlargkiw.sbs
-
https://allocatinow.sbs
-
https://mathcucom.sbs
-
https://clearancek.site
-
https://licendfilteo.site
-
https://spirittunek.store
-
https://bathdoomgaz.store
-
https://studennotediw.store
-
https://dissapoiznw.store
-
https://eaglepawnoy.store
-
https://mobbipenju.store
Extracted
-
stealc
-
default_valenciga
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
amadey
-
4.42
-
9c9aa5
-
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
-
redline
-
TG CLOUD @RLREBORN Admin @FATHEROFCARDERS
-
89.105.223.196:29862
Extracted
-
stealc
-
doma
-
http://185.215.113.37
-
url_path
/e2b1563c6670f193.php
Extracted
-
amadey
-
4.41
-
1176f2
-
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 26 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Executes dropped EXE 32 IoCs
- Identifies Wine through registry keys 2 TTPs 13 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 5 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Windows security modification 2 TTPs 2 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Kills process with taskkill 2 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 45 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\86b9d17c28f513e6610f028215365d251053d95326a6e2d4dc5d3d84d791887e.exe"C:\Users\Admin\AppData\Local\Temp\86b9d17c28f513e6610f028215365d251053d95326a6e2d4dc5d3d84d791887e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 12204⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tW3lXIBtNw.exe"C:\Users\Admin\AppData\Roaming\tW3lXIBtNw.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\pDn6cvCk8v.exe"C:\Users\Admin\AppData\Roaming\pDn6cvCk8v.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 2524⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000354001\e3712cfedd.exe"C:\Users\Admin\AppData\Local\Temp\1000354001\e3712cfedd.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000355001\dfc22232a4.exe"C:\Users\Admin\AppData\Local\Temp\1000355001\dfc22232a4.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000349001\dd935631ba.exe"C:\Users\Admin\AppData\Local\Temp\1000349001\dd935631ba.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\1000350002\a53e864ea4.exe"C:\Users\Admin\1000350002\a53e864ea4.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000357001\52bfcbe041.exe"C:\Users\Admin\AppData\Local\Temp\1000357001\52bfcbe041.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000401001\num.exe"C:\Users\Admin\AppData\Local\Temp\1000401001\num.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000091001\2927.exe"C:\Users\Admin\AppData\Local\Temp\1000091001\2927.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-JRF6D.tmp\2927.tmp"C:\Users\Admin\AppData\Local\Temp\is-JRF6D.tmp\2927.tmp" /SL5="$701E0,922170,832512,C:\Users\Admin\AppData\Local\Temp\1000091001\2927.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-G8716.tmp\my.bat""7⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000092001\JavUmar1.exe"C:\Users\Admin\AppData\Local\Temp\1000092001\JavUmar1.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start context.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\context.execontext.exe5⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "InstallUtil.exe"8⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "InstallUtil.exe"6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMAA0ADIANAAwADAAMQBcAGEAcABwAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADAANAAyADQAMAAwADEAXABhAHAAcAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABzAHEAZABxAHMAZAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAHMAcQBkAHEAcwBkAC4AZQB4AGUA4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 552 -ip 5521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4676 -ip 46761⤵
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
77EC63BDA74BD0D0E0426DC8F8008506
gold.exe
legas.exe
stealc_default2.exe
2927.exe
JavUmar1.exe
dd935631ba.exe
e3712cfedd.exe
dfc22232a4.exe
52bfcbe041.exe
MK.exe
num.exe
Nework.exe
processclass.exe
splwow64.exe
app.exe
227495264221
axplong.exe
TmpC12D.tmp
__PSScriptPolicyTest_woltxi3m.yig.ps1
idp.dll
2927.tmp
Office Manager.url
pDn6cvCk8v.exe
tW3lXIBtNw.exe
memory/232-0-0x0000000000820000-0x0000000000CE0000-memory.dmp
memory/232-17-0x0000000000820000-0x0000000000CE0000-memory.dmp
memory/232-4-0x0000000000820000-0x0000000000CE0000-memory.dmp
memory/232-3-0x0000000000820000-0x0000000000CE0000-memory.dmp
memory/232-2-0x0000000000821000-0x000000000084F000-memory.dmp
memory/232-1-0x00000000777A4000-0x00000000777A6000-memory.dmp
memory/552-50-0x0000000000C00000-0x0000000000FDD000-memory.dmp
memory/1048-391-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1048-424-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1224-131-0x000000001BE60000-0x000000001BE9C000-memory.dmp
memory/1224-189-0x000000001E8B0000-0x000000001EA72000-memory.dmp
memory/1224-127-0x000000001BBF0000-0x000000001BC02000-memory.dmp
memory/1224-122-0x000000001D360000-0x000000001D46A000-memory.dmp
memory/1224-103-0x00000000000F0000-0x000000000018C000-memory.dmp
memory/1224-154-0x000000001DE30000-0x000000001DEA6000-memory.dmp
memory/1224-155-0x000000001ADA0000-0x000000001ADBE000-memory.dmp
memory/1648-20-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-53-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-539-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-18-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-19-0x0000000000C91000-0x0000000000CBF000-memory.dmp
memory/1648-30-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-31-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-542-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-22-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-47-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-237-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-425-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-21-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/1648-495-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/2000-446-0x0000000000DA0000-0x00000000010BA000-memory.dmp
memory/2000-407-0x0000000000DA0000-0x00000000010BA000-memory.dmp
memory/2044-422-0x0000000000400000-0x000000000071C000-memory.dmp
memory/2336-356-0x000000000B9A0000-0x000000000BA24000-memory.dmp
memory/2336-353-0x0000000000E00000-0x0000000000F18000-memory.dmp
memory/2460-233-0x00000000055F0000-0x0000000005B94000-memory.dmp
memory/2460-232-0x0000000000710000-0x0000000000764000-memory.dmp
memory/2636-104-0x0000000000450000-0x00000000004B8000-memory.dmp
memory/2636-191-0x000000001F940000-0x000000001FE68000-memory.dmp
memory/4084-69-0x0000000000400000-0x0000000000531000-memory.dmp
memory/4084-100-0x0000000000400000-0x0000000000531000-memory.dmp
memory/4084-71-0x0000000000400000-0x0000000000531000-memory.dmp
memory/4084-70-0x0000000000400000-0x0000000000531000-memory.dmp
memory/4144-188-0x0000000000480000-0x000000000092C000-memory.dmp
memory/4144-227-0x0000000000480000-0x000000000092C000-memory.dmp
memory/4240-586-0x0000000007D80000-0x0000000007EAC000-memory.dmp
memory/4240-584-0x0000000000C60000-0x00000000020C6000-memory.dmp
memory/4240-1661-0x0000000007F80000-0x0000000008026000-memory.dmp
memory/4240-1662-0x0000000008190000-0x00000000081DC000-memory.dmp
memory/4240-1711-0x0000000006500000-0x0000000006554000-memory.dmp
memory/4264-26-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/4264-28-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/4264-24-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/4264-29-0x0000000000C91000-0x0000000000CBF000-memory.dmp
memory/4264-25-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/4264-112-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/4280-468-0x00000000004C0000-0x000000000090A000-memory.dmp
memory/4280-467-0x00000000004C0000-0x000000000090A000-memory.dmp
memory/4280-534-0x00000000004C0000-0x000000000090A000-memory.dmp
memory/4280-522-0x00000000004C0000-0x000000000090A000-memory.dmp
memory/4280-469-0x00000000004C0000-0x000000000090A000-memory.dmp
memory/4316-490-0x0000000000C10000-0x0000000000E71000-memory.dmp
memory/4316-486-0x0000000000C10000-0x0000000000E71000-memory.dmp
memory/4324-333-0x0000000000AB0000-0x0000000000AB8000-memory.dmp
memory/4332-276-0x0000000006410000-0x000000000642E000-memory.dmp
memory/4332-308-0x0000000006D30000-0x0000000006D7C000-memory.dmp
memory/4332-235-0x0000000000400000-0x0000000000452000-memory.dmp
memory/4332-363-0x00000000067F0000-0x0000000006856000-memory.dmp
memory/4332-274-0x0000000005C50000-0x0000000005CC6000-memory.dmp
memory/4332-287-0x0000000006DA0000-0x00000000073B8000-memory.dmp
memory/4332-239-0x00000000050D0000-0x00000000050DA000-memory.dmp
memory/4332-441-0x000000000A880000-0x000000000ADAC000-memory.dmp
memory/4332-435-0x000000000A180000-0x000000000A342000-memory.dmp
memory/4332-426-0x0000000009E20000-0x0000000009E70000-memory.dmp
memory/4332-293-0x0000000008620000-0x000000000872A000-memory.dmp
memory/4332-299-0x0000000006CF0000-0x0000000006D2C000-memory.dmp
memory/4332-238-0x0000000005010000-0x00000000050A2000-memory.dmp
memory/4332-294-0x0000000006C90000-0x0000000006CA2000-memory.dmp
memory/4420-139-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4420-113-0x0000000000620000-0x0000000000881000-memory.dmp
memory/4420-334-0x0000000000620000-0x0000000000881000-memory.dmp
memory/4448-448-0x00000000007C0000-0x0000000000E6B000-memory.dmp
memory/4448-444-0x00000000007C0000-0x0000000000E6B000-memory.dmp
memory/4588-225-0x0000000000390000-0x000000000083C000-memory.dmp
memory/4588-538-0x0000000000390000-0x000000000083C000-memory.dmp
memory/4588-541-0x0000000000390000-0x000000000083C000-memory.dmp
memory/4588-404-0x0000000000390000-0x000000000083C000-memory.dmp
memory/4588-471-0x0000000000390000-0x000000000083C000-memory.dmp
memory/4588-419-0x0000000000390000-0x000000000083C000-memory.dmp
memory/4836-132-0x00000000004E0000-0x0000000000B8B000-memory.dmp
memory/4836-354-0x00000000004E0000-0x0000000000B8B000-memory.dmp
memory/4836-412-0x00000000004E0000-0x0000000000B8B000-memory.dmp
memory/5304-540-0x0000000000690000-0x0000000000CD7000-memory.dmp
memory/5304-512-0x0000000069CC0000-0x000000006A37B000-memory.dmp
memory/5396-525-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5396-536-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5396-524-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5396-526-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5432-1682-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
memory/5432-1684-0x0000000073790000-0x00000000737DC000-memory.dmp
memory/5432-1701-0x00000000071D0000-0x00000000071E1000-memory.dmp
memory/5432-1706-0x00000000072F0000-0x00000000072F8000-memory.dmp
memory/5432-1667-0x00000000026C0000-0x00000000026F6000-memory.dmp
memory/5432-1668-0x0000000004DA0000-0x00000000053C8000-memory.dmp
memory/5432-1669-0x0000000005510000-0x0000000005532000-memory.dmp
memory/5432-1675-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/5432-1705-0x0000000007310000-0x000000000732A000-memory.dmp
memory/5432-1680-0x0000000005830000-0x0000000005B84000-memory.dmp
memory/5432-1681-0x0000000005CA0000-0x0000000005CBE000-memory.dmp
memory/5432-1704-0x0000000007210000-0x0000000007224000-memory.dmp
memory/5432-1683-0x0000000006270000-0x00000000062A2000-memory.dmp
memory/5432-1703-0x0000000007200000-0x000000000720E000-memory.dmp
memory/5432-1694-0x0000000006E70000-0x0000000006E8E000-memory.dmp
memory/5432-1695-0x0000000006EA0000-0x0000000006F43000-memory.dmp
memory/5432-1697-0x0000000007610000-0x0000000007C8A000-memory.dmp
memory/5432-1698-0x0000000006FD0000-0x0000000006FEA000-memory.dmp
memory/5432-1699-0x0000000007040000-0x000000000704A000-memory.dmp
memory/5432-1700-0x0000000007250000-0x00000000072E6000-memory.dmp
memory/5776-544-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5776-552-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5776-545-0x0000000000400000-0x0000000000471000-memory.dmp
memory/5824-1715-0x0000000000960000-0x00000000009BE000-memory.dmp
memory/6012-561-0x0000000000390000-0x000000000083C000-memory.dmp
memory/6012-556-0x0000000000390000-0x000000000083C000-memory.dmp
memory/6048-558-0x0000000000C90000-0x0000000001150000-memory.dmp
memory/6048-559-0x0000000000C90000-0x0000000001150000-memory.dmp